Privacy breach and notification FAQ
Short answers to the Canadian breach questions that come up first: does this count, is there a real risk of significant harm, who has to be told and when, what records to keep, and where the provinces differ.
Does PIPEDA require breach notification?
Yes. PIPEDA requires an organization to report to the Privacy Commissioner of Canada any breach of security safeguards that creates a real risk of significant harm to an individual, and to notify affected individuals as soon as feasible. It must also notify organizations that can reduce the harm and keep a record of every breach, reportable or not.
Is it a breach?
PIPEDA uses the term 'breach of security safeguards': the loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of an organization's security safeguards, or from a failure to put them in place. A hacked mailbox, a stolen unencrypted laptop and an email sent to the wrong client can all qualify.
Unauthorized access is enough to be a breach. Whether it must be reported depends on the risk assessment below. 'We have no evidence data was taken' is not the same as 'data was not taken', which is why logs and forensic review matter before you decide.
Strong encryption with keys that were not also exposed can significantly lower the risk. Encryption on a laptop that was stolen while unlocked, or files encrypted with a password written on a sticky note, is a different story. Document why you believe the protection held.
Real risk of significant harm
Real risk of significant harm is PIPEDA's reporting threshold. Significant harm is broad: it includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft and negative effects on a credit record. The Office of the Privacy Commissioner of Canada says to assess the risk by looking at the sensitivity of the personal information and the probability that it has been, is being or will be misused.
Signs of malicious intent (a criminal intrusion versus a misdirected email to a trusted professional), evidence the data has been posted or used, how long it was exposed, and whether it could be recovered. A ransomware group that exfiltrated files is a very different fact pattern from a clerical error caught in minutes.
The organization that controls the personal information makes and documents the assessment, ideally with counsel. Technical findings feed it, but the conclusion is a legal one.
Who must be notified and when
If there is a real risk of significant harm: the Office of the Privacy Commissioner of Canada, the affected individuals, and any other organization or government institution that may be able to reduce the risk of harm (a bank, for example).
The law requires notice to individuals as soon as feasible after you determine the breach creates a real risk of significant harm. The regulator report is also expected as soon as feasible. There is no fixed number of days in PIPEDA, but 'as soon as feasible' is not an invitation to wait for a complete investigation.
Generally the organization that controls the information reports. Service providers should tell their client promptly so the client can assess and report, and should check their contract, which often sets a shorter notice period than the law.
Records you must keep
Under the Breach of Security Safeguards Regulations (SOR/2018-64), an organization must keep a record of every breach of security safeguards for 24 months after the day it determines the breach occurred, including breaches that did not meet the reporting threshold. The record must contain enough information to let the Commissioner verify compliance with the reporting and notification rules.
- Date or estimated date of the breach and the date you discovered it
- What happened and what personal information was involved
- Your real-risk-of-significant-harm assessment and the reasons for it
- Whether and when you reported to the regulator and notified individuals
- Steps taken to reduce harm and prevent recurrence
Privacy breach rules in Ontario and other provinces
Quebec also requires every enterprise to keep a register of confidentiality incidents (s. 3.8), whether or not they are reported. Ontario health information custodians must give the IPC an annual report of the previous calendar year's breach statistics by March 1. Organizations operating in several provinces can face more than one regime for the same incident, so map where affected people live early.
| Regime | Trigger | Who is notified | Timing language |
|---|---|---|---|
PIPEDA (federal private sector) | Real risk of significant harm | OPC, individuals, organizations that can reduce harm | As soon as feasible |
Quebec private sector act (Law 25), s. 3.5 | Confidentiality incident presenting a risk of serious injury | Commission d'accès à l'information and the persons concerned | Promptly |
Alberta PIPA, s. 34.1 | Incident where a reasonable person would consider there is a real risk of significant harm | Alberta Information and Privacy Commissioner (who may require notice to individuals) | Without unreasonable delay |
Ontario PHIPA (health information custodians) | Theft, loss or unauthorized use or disclosure; IPC reports in seven prescribed categories | Individuals, and the IPC where prescribed | At the first reasonable opportunity |
Related.
- ArticleReal risk of significant harm: how the assessment worksWhether a Canadian privacy breach must be reported usually turns on one judgment: does it create a real risk of significant harm? The legal test is short.
- ArticlePIPEDA breach reporting and record-keepingPIPEDA has three linked breach duties: report serious breaches to the Privacy Commissioner, notify the people affected, and keep a record of every breach, even the small…
- ServicePrivacy breach assessment and notification supportAfter a cyber incident, someone has to turn log files and mailbox exports into a defensible answer to three questions: whose information was involved, how much risk it…
- ArticleQuebec's Law 25: What Ontario & GTA Businesses Serving Quebec Customers Need to KnowIf your Ontario business collects personal information from Quebec residents, Quebec's Law 25 privacy rules can apply to you.
- PracticePrivacy, Data Governance & AIPIPEDA and Quebec Law 25 readiness, data mapping, breach notification and AI governance.
Not sure what your obligations require of your systems?
Speak with our privacy practice. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.